SECURITY: python per-user conversation scoping (th-8fe998)

[brentrager]

SECURITY — cross-user conversation leak in the Python server

The vulnerability. list_conversations took no user filter, so it returned every user's conversations. The resume path (create_conversation_session with a conversationId) and the sessionId-bearing actions were not owner-checked either. Any authenticated user could enumerate and open anyone else's chats.

Part of the SECURITY epic th-8fe998, closed across all five language lanes simultaneously. Python lane (python/server/) only.

The fix

Ownership is driven by the connection's authenticated principal — the JWT email claim, now carried on Principal — and never by client-supplied input. The userName / userEmail frame fields were the spoofing vector; with auth enabled the principal's email also replaces userEmail as the OTP contact, so a verification code can't be delivered to a client-chosen address.

• list_conversations(user_email) is scoped to the caller. The filter is applied in the store's selection, not after the dispatcher's limit — filtering a limited page silently returns short/empty pages.
• create_conversation_session (resume), get_session, send_message and verify_otp all route through one _visible_session guard, so the check sits where every caller passes rather than on the one path the report named.
• No existence oracle. Someone else's id is indistinguishable from an id that never existed: the resume path takes the same branch as unknown (mints a fresh conversation), and the session actions return the same SESSION_NOT_FOUND payload. A test asserts the actual response bytes are identical, not merely that both fail.
• Fail closed. Auth enabled + a principal with no email ⇒ empty list, resume/get denied — never a silent fallback to unscoped. An invalid/expired/absent token under an enabled verifier resolves to a new ANONYMOUS_ENFORCED context (previously it fell back to the auth-disabled anonymous, which would now read as unscoped). A session stored with no owner is invisible to everyone. Auth disabled (local single-tenant) is the only unscoped path and is unchanged.

Breaking interface change (deliberate)

SessionStore.list_conversations now takes a required user_email parameter, not an optional defaulting to None/unscoped. A default would be fail-OPEN and would let downstream implementers of the store protocol ship a cross-user-leaking store without ever confronting the question. create_session gains keyword-only owner_email; StoredSession gains owner_email. Migration is documented in the changeset.

Verification

Adversarial tests in python/server/tests/test_conversation_scoping.py, written from the attacker's side: A's list excludes B's; A resuming B's conversation gets a fresh one and B's log is untouched; A probing B's session on each of the three session actions gets SESSION_NOT_FOUND; not-yours vs never-existed compared on actual payloads; a client claiming another user's email in the create frame gets its own scope; emailless principal and enforced-anonymous see nothing; unowned conversations invisible; auth-disabled unscoped behavior preserved; and the store rejects a scope-less list_conversations() call.

uv run pytest — 198 passed (180 pre-existing, all still green). ruff check and ruff format --check clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_01331RwggrhiP9UJVao9dr1F

[changeset-bot]

🦋 Changeset detected

Latest commit: 9f7f13c

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@smooai/smooth-operator	Minor
@smooai/smooth-operator-web-chat-example	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR